SANS ISC InfoSec Forums

Blue Coat has released a security advisory for SSL Visibility Appliance. The SSL Visibility Appliance is susceptible to multiple web-based vulnerabilities in the administration console. A remote attacker can use these vulnerabilities to obtain administrative access to the SSL Visibility Appliance. All versions of SSL Visibility prior to 3.8.4 are vulnerable.

Cookie theft (CVE-2015-2855): The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138.

Limit access to the SSL Visibility management port to trusted clients with limited access to the outside internet. SSLV can be configured to limit the IP addresses capable of accessing the management port.

Limit administrative capabilities by assigning distinct roles for different types of administrators.

Use ProxySG and WebPulse to block access to malicious websites from clients.

Patches:

SSL Visibility
SSLV 3.8 – a fix is available in 3.8.4.
SSLV 3.8.2f – a fix will not be provided. Please upgrade to the latest release with the vulnerability fix.
SSLV 3.7.4 – a fix will not be provided. Please upgrade to the latest release with the vulnerability fix.